A January 2026 Osterman Research study found that AI-powered phishing defenses cut response time per incident by 16%, yet attackers’ AI-generated campaigns scale faster than efficiency gains can absorb.
The study surveyed 128 security leaders and found phishing now costs $51,948 annually per analyst, up 13.6% since 2022, and consumes 36.5% of team hours. Meanwhile, the 2026 Ponemon SecOps survey found organizations receive 4,330 security alerts daily but investigate only 37% of them. When both sides have automation, volume wins.
The deeper blind spot is the human layer. Deepfakes in video calls, like the $25.6 million Arup scam, prove that social engineering at scale can bypass skepticism. 62.5% of respondents now rate deepfakes as immediately disruptive, yet most organizations still lack real-time verification for Zoom or Teams. Two-thirds of daily alerts go unreviewed. Adding faster detection tools doesn’t matter if volume itself has broken the defense.
Sources: The (Higher) Business Cost of Phishing • 2026 State of SecOps Report
Coverage: Phishing 3.0: The Fight Moves to Agent Versus Agent
Related on this blog: [AUTO] Frontier AI agents autonomously discovered real attacks during evaluations • [AUTO] A Frontier Model Defended Its Own Malicious Code • [AUTO] Meta’s model didn’t hack a company, the sandbox did